METHOD OF STOPPING INTERNET VIRUSES 

CROSS REFERENCE TO RELATED APPLICATION 
The present application is a continuation of U.S. 
Application Serial No. 60/212,003, filed June 16, 2000. 

BACKGROUND OF THE INVENTION 

A. Field of the invention 

The present invention relates to methods and systems for 
blocking computer viruses in computer Email attachments. 

B. Description of the prior art 

One of the most serious threats to Internet Commerce is 
the threat of a coordinated attack on the Internet system by 
a foreign government or terrorist which could launch hundreds 
of viruses at the same time, causing a complete shutdown of 
the internet system. In addition, there are computer hacks 
who are constantly devising viruses which are capable of blocking 
private and commercial systems, causing millions of dollars 
in damage to commerce and an enormous cost of repairing the 
damage for the average user. 

A number of systems have been designed to screen and block 
viruses, however, they only work after the virus has been 
identified and an identifier has been installed on user 
computers. When new viruses or worms are introduced. The 
current systems do not stop the viruses. In addition, since 
there are so many viruses to check for, the process takes a 
lot of computer time and must be updated regularly. 
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One such virus is the "I Love You H letter which was felt 
worldwide and caused 8.7 billion dollars according to research 
from Computer Economics. An article in the July 2000 Popular 
Science Magazine (page 48) the "Love Bug" is relatively 
lightweight, from a technical perspective. More recently, two 
worms were released that caused major commercial disruption. 
Over one million computers were affected and it stopped some 
railroad service and complicated registration at colleges. 

The proliferation of computers in the workforce today has 
significantly increased the importance of electronic data 
storage, the loss of which can lead to unacceptable disruptions 
of operations. Many computer users have virus screening and 
detection software installed on their computers. 

In response, data recovery methods have been implemented 
such as the method disclosed in U.S. Patent No. 6,363,487. 
A system is disclosed for a protected data storage medium. 
The protected data storage medium includes a storage medium 
that includes a protected area. In addition, the protected 
data storage includes a controller that is capable of controlling 
access to the storage medium. Other related systems are 
disclosed in U.S. Patent Nos. 5,889,943; 5,964,889; 6,338,141; 
and 6,591 ,362. 

SUMMARY OF THE INVENTION 

The present invention provides a method for stopping 
internet viruses from spreading and damaging computer memory 
systems. To prevent Email distributed viruses from activating 



in a protected computer/ the method comprises three routines. 
The first routine is to be inserted in the program which receives 
Email attachments. The second routine is to be inserted in 
the program that opens attachments. The third routine is to 
be inserted in the program that forwards Email. 

BRIEF DESCRIPTION OF THE DRAWINGS 

Fig. 1 is a flow chart of the routine for the program 
which receives Email attachments. 

Fig. 2 is a flow chart of the routine for the program 
that opens attachments. 

Fig. 3 is a flow chart of the routine for the program that 
forwards Email. 

BEST MODE OF CARRYING OUT THE INVENTION 

As shown in the accompanying figures, the routine to be 
inserted in the program which receives Email attachments is 
designated by the numeral 10, the routine to be inserted in 
the program that opens attachments is designated by the 
numeral 11, and the routine to be inserted in the program that 
forwards Email is designated by the numeral 12. 

The first step 13 of the method of stopping internet viruses 
is to insert routine 10 into the user's computer program which 
receives attachments from the Email server. Then check the 
first packet flag 1 4 to see if this is the first packet for 
this attachment : ' 

(Note: the flag would be initialized to say first packet 
has not come in . ) 



(Note: Email is sent in packets or small groups of data 
and then assembled at the destination. Since this method is 
only concerned with the first 64 bits of data, only the first 
packet of data need be addressed). If this is the first 
packet 14, set the first packet flag 15 to say first packet 
has come in. If not, go to step 18. Move the first 64 bits 
of data to a reserved place in a header 16 for this attachment. 
Put a binary zero into the first 64 bits of data 17 for this 
attachment (Note: binary zero is a halt command to a program.) 
Continue the normal Email receiving program 18. 

The second step 19 of stopping internet viruses is to insert 
the routine 11 in the program that opens attachments. The next 
step is to create a window 20 that asks the user if they like 
to. replace the first 64 bits of data 21 in the attachment. 

(Note: One can readily see a text or a picture attachment 
and have no problems identifying those as valid attachments. 
If one cannot identify the attachment, they should not replace 
the 64 bits of data until they check with the sender. Also, 
this window should display the length of the attachment to aid 
in the determination of viruses. If viruses are known to exist, 
the media could publicize the length to alert computer users). 

Did the user type a 11 Y M indicating they want the bits 
replaced? If a M Y" is typed, move the 64 bits from the 
header 22 into the first 64 bits of data. If not, continue 
to the next step. Exit the window 23. 
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The third step 24 of stopping internet viruses is to insert 
the routine 12 into the user's computer program that forwards 
Email. Check the first packet out 25 flag to see if this is 
the first packet out. 

(Note: the first packet out flag 25 is initialized to say 

first packet out). 

If this is the first packet out, set first packet flag 26 to 
say not the first packet. If this is not the first packet out, 
continue Email forward routine 29. Check to see if the first 
64 bits of data has been replaced 27. If the data has not been 
replaced, replace the first 64 bits of data with stored 
data 28. Continue the Email forward routine 29. 

The method of stopping internet viruses presents options 
the user must make and presents information to aid in that 
decision. 

Although the invention has been described by way of example 
and with reference to possible embodiments it is to be 
appreciated that improvements and/or modifications may be made 
to these embodiments without departing from the scope of the 
invention. 
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